Incident Handling, Disaster Recovery, and Forensics
What the exam tests
This domain covers the incident response lifecycle, business continuity and disaster recovery planning and metrics, backup and restoration, and forensic handling of digital evidence. Questions often ask what you do first, who declares a disaster, which plan applies, and how evidence stays admissible.
Core rules
- IR lifecycle: preparation; detection and analysis; containment, eradication, and recovery; post-incident activity. Containment protects evidence and stops spread; eradication removes the cause.
- BCP vs. DRP. BCP keeps business processes running; DRP restores technology and infrastructure. The BIA feeds both.
- RTO is how long recovery may take; RPO is how much data loss is acceptable; MTD is the longest outage the business survives. RTO must be shorter than MTD.
- Backups: 3 copies, 2 media types, 1 offsite, and at least one immutable or offline. Test restoration, not just backup jobs.
- Forensics: order of volatility - memory and network state before disk, disk before archival media. Document chain of custody, hash evidence, use write blockers, and never work on the original.
Worked example
Ransomware is detected on a finance file server. The analyst wants to shut it down immediately. Better reasoning: isolate the host from the network (containment) without powering it off, because volatile memory may hold encryption keys, the process list, and remote-access artifacts. Preserve memory, image the disk with a write blocker, hash it, and log custody. Then validate backups, restore to a clean segment, and reconnect only after eradication. The decision is evidence-first containment, not deletion.
Traps
- Powering off or rebooting a suspect host and destroying volatile evidence.
- Deleting malware before imaging.
- Confusing RTO with RPO, or RPO with backup frequency.
- Restoring systems before containment, which re-infects the environment.
- Calling a DR test a BCP test, or skipping restoration validation.